landlock: Enforce capability restrictions

Add Landlock enforcement for capability use via the LSM capable hook.
This lets a sandboxed process restrict which Linux capabilities it can
exercise, using LANDLOCK_PERMISSION_CAPABILITY_USE and per-capability
rules.

The check is a flat per-layer allowed-capabilities test, with no
domain-ancestry bypass, no cross-namespace discriminant, and no
dependency on the target user namespace.  These categorical denials
return -EPERM, like the namespace permission introduced by the previous
commit, and they mirror its per-capability allowed and quiet masks, so
LANDLOCK_ADD_RULE_QUIET stays rejected for this rule type.  Successful
capability rules and denials are traced as the previous commit
describes.

Enforce only at capability exercise time rather than modifying the
credential's capability sets.  Modifying them would give capget(2) an
accurate view of usable capabilities, but no LSM other than commoncap
does so; Landlock follows that convention.  A sandboxed process inside a
user namespace therefore sees all capabilities via capget(2) but
receives -EPERM when attempting to use one that is denied.

An earlier design bypassed this hook for namespace management through a
domain-ancestry comparison with the namespace creator's stored Landlock
domain.  That made a Landlock decision depend on kernel namespace state,
and the ns != cred->user_ns heuristic did not accurately identify
namespace-management operations.  The flat, namespace-agnostic check
instead enforces capability and namespace restrictions independently;
creating a non-user namespace requires an allowed CAP_SYS_ADMIN even
when combined with CLONE_NEWUSER in one unshare().

Cc: Christian Brauner <brauner@kernel.org>
Cc: Günther Noack <gnoack@google.com>
Cc: Paul Moore <paul@paul-moore.com>
Cc: Serge E. Hallyn <serge@hallyn.com>
Link: https://patch.msgid.link/20261014082718.1435842-5-mic@digikod.net
Signed-off-by: Mickaël Salaün <mic@digikod.net>

1 files changed, 49 insertions, 0 deletions

diff --git a/include/uapi/linux/landlock.h b/include/uapi/linux/landlock.h
index bb8ec589ddac..3128e58d4b78 100644
--- a/include/uapi/linux/landlock.h
+++ b/include/uapi/linux/landlock.h
@@ -237,6 +237,11 @@ enum landlock_rule_type {
 	 * @LANDLOCK_RULE_NAMESPACE: Type of a &struct landlock_namespace_attr .
 	 */
 	LANDLOCK_RULE_NAMESPACE,
+	/**
+	 * @LANDLOCK_RULE_CAPABILITY: Type of a &struct
+	 * landlock_capability_attr .
+	 */
+	LANDLOCK_RULE_CAPABILITY,
 };
 
 /**
@@ -326,6 +331,42 @@ struct landlock_namespace_attr {
 };
 
 /**
+ * struct landlock_capability_attr - Capability definition
+ *
+ * Argument of sys_landlock_add_rule() with %LANDLOCK_RULE_CAPABILITY.
+ */
+struct landlock_capability_attr {
+	/**
+	 * @permissions: Must be set to %LANDLOCK_PERMISSION_CAPABILITY_USE.
+	 */
+	__u64 permissions;
+	/**
+	 * @allowed_capabilities: Bitmask of capabilities (``1ULL << CAP_*``) to
+	 * allow under this rule.  Bits above ``CAP_LAST_CAP`` are silently
+	 * ignored for forward compatibility.
+	 */
+	__u64 allowed_capabilities;
+	/**
+	 * @quiet_capabilities: Bitmask of capabilities (``1ULL << CAP_*``)
+	 * whose denial by this layer should not be submitted to audit, even if
+	 * audit logging would normally take place per landlock_restrict_self()
+	 * flags.  Only audit records attributed to this layer are suppressed;
+	 * denial tracepoints still fire (see `Permission flags`_).  Bits also
+	 * set in @allowed_capabilities have no effect, since an allowed
+	 * capability is never denied.  Bits above ``CAP_LAST_CAP`` are silently
+	 * ignored.
+	 *
+	 * At least one of @allowed_capabilities or @quiet_capabilities must be
+	 * non-zero, otherwise the call returns ``-ENOMSG``.  The non-zero check
+	 * runs on the raw input before unknown-bit masking, so a rule that sets
+	 * only bits unknown to the running kernel (above ``CAP_LAST_CAP``)
+	 * succeeds but has no runtime effect.  Programs should omit this rule
+	 * when they neither allow nor quiet a capability.
+	 */
+	__u64 quiet_capabilities;
+};
+
+/**
  * DOC: fs_access
  *
  * A set of actions on kernel objects may be defined by an attribute (e.g.
@@ -577,7 +618,15 @@ struct landlock_namespace_attr {
  *   Landlock domain that handles this permission is denied from using namespace
  *   types that are not explicitly allowed by a %LANDLOCK_RULE_NAMESPACE rule.
  *   Support added in Landlock ABI version 12.
+ * - %LANDLOCK_PERMISSION_CAPABILITY_USE: Restrict the use of specific Linux
+ *   capabilities.  A process in a Landlock domain that handles this permission
+ *   is denied from exercising capabilities that are not explicitly allowed by a
+ *   %LANDLOCK_RULE_CAPABILITY rule.  This hook is purely restrictive: it can
+ *   deny capabilities that the kernel would otherwise grant, but it can never
+ *   grant capabilities that the kernel already denied.  Support added in
+ *   Landlock ABI version 12.
  */
 #define LANDLOCK_PERMISSION_NAMESPACE_USE			(1ULL << 0)
+#define LANDLOCK_PERMISSION_CAPABILITY_USE			(1ULL << 1)
 
 #endif /* _UAPI_LINUX_LANDLOCK_H */